DPDK patches and discussions
 help / color / mirror / Atom feed
* [dpdk-dev] [PATCH] security: allow application to specify UDP ports to PMD
@ 2020-09-03  6:42 Tejasree Kondoj
  2020-09-10 19:09 ` Akhil Goyal
  0 siblings, 1 reply; 7+ messages in thread
From: Tejasree Kondoj @ 2020-09-03  6:42 UTC (permalink / raw)
  To: Akhil Goyal, Radu Nicolau
  Cc: Tejasree Kondoj, Narayana Prasad, Anoob Joseph, dev

Add UDP source and destination ports in ipsec_xform to allow application
to specify ports to be used for IPsec UDP encapsulation as they are
dynamically changed by NAT in between. Also adding an extra flag to
indicate whether PMD needs to perform encapsulation header verification
in case of inbound. In case of inline IPsec implementation, verification
of outer IP headers and UDP encapsulation headers need to be handled
in the PMD. For lookaside IPsec, application can optionally offload
this to the PMD.

Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 lib/librte_security/rte_security.h | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/lib/librte_security/rte_security.h b/lib/librte_security/rte_security.h
index 16839e539..670bdeb6b 100644
--- a/lib/librte_security/rte_security.h
+++ b/lib/librte_security/rte_security.h
@@ -130,6 +130,13 @@ struct rte_security_ipsec_sa_options {
 	 */
 	uint32_t udp_encap : 1;
 
+	/** Verify tunnel header and UDP encapsulation ports in inbound
+	 *
+	 * * 1: Match outer header source, destination addresses and UDP ports
+	 * * 0: Do not match outer IP addresses and UDP ports
+	 */
+	uint32_t encap_hdr_verify : 1;
+
 	/** Copy DSCP bits
 	 *
 	 * * 1: Copy IPv4 or IPv6 DSCP bits from inner IP header to
@@ -190,6 +197,16 @@ enum rte_security_ipsec_sa_direction {
 	/**< Verify digest and decrypt */
 };
 
+/**
+ * UDP encapsulation ports
+ */
+struct rte_security_ipsec_udp_encapsulation {
+	uint16_t src_port;
+	/**< UDP source port */
+	uint16_t dst_port;
+	/**< UDP destination port */
+};
+
 /**
  * IPsec security association configuration data.
  *
@@ -216,6 +233,8 @@ struct rte_security_ipsec_xform {
 	/**< Anti replay window size to enable sequence replay attack handling.
 	 * replay checking is disabled if the window size is 0.
 	 */
+	struct rte_security_ipsec_udp_encapsulation udp_encap;
+	/**< UDP encapsulation ports */
 };
 
 /**
-- 
2.27.0


^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [dpdk-dev] [PATCH] security: allow application to specify UDP ports to PMD
  2020-09-03  6:42 [dpdk-dev] [PATCH] security: allow application to specify UDP ports to PMD Tejasree Kondoj
@ 2020-09-10 19:09 ` Akhil Goyal
  2020-09-21  9:13   ` Tejasree Kondoj
  0 siblings, 1 reply; 7+ messages in thread
From: Akhil Goyal @ 2020-09-10 19:09 UTC (permalink / raw)
  To: Tejasree Kondoj, Radu Nicolau; +Cc: Narayana Prasad, Anoob Joseph, dev

Hi Tejasree,

> Add UDP source and destination ports in ipsec_xform to allow application
> to specify ports to be used for IPsec UDP encapsulation as they are
> dynamically changed by NAT in between. Also adding an extra flag to
> indicate whether PMD needs to perform encapsulation header verification
> in case of inbound. In case of inline IPsec implementation, verification
> of outer IP headers and UDP encapsulation headers need to be handled
> in the PMD. For lookaside IPsec, application can optionally offload
> this to the PMD.
> 
> Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
> ---

I think we should add some usage of these newly added params 
- either in app/test or in examples/ipsec-secgw

Regards,
Akhil

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [dpdk-dev] [PATCH] security: allow application to specify UDP ports to PMD
  2020-09-10 19:09 ` Akhil Goyal
@ 2020-09-21  9:13   ` Tejasree Kondoj
  2020-09-21  9:30     ` Akhil Goyal
  0 siblings, 1 reply; 7+ messages in thread
From: Tejasree Kondoj @ 2020-09-21  9:13 UTC (permalink / raw)
  To: Akhil Goyal, Radu Nicolau; +Cc: Narayana Prasad Raju Athreya, Anoob Joseph, dev

Hi Akhil,

Please see inline.

Thanks
Tejasree

> -----Original Message-----
> From: Akhil Goyal <akhil.goyal@nxp.com>
> Sent: Friday, September 11, 2020 12:39 AM
> To: Tejasree Kondoj <ktejasree@marvell.com>; Radu Nicolau
> <radu.nicolau@intel.com>
> Cc: Narayana Prasad Raju Athreya <pathreya@marvell.com>; Anoob Joseph
> <anoobj@marvell.com>; dev@dpdk.org
> Subject: [EXT] RE: [PATCH] security: allow application to specify UDP ports to
> PMD
> 
> External Email
> 
> ----------------------------------------------------------------------
> Hi Tejasree,
> 
> > Add UDP source and destination ports in ipsec_xform to allow
> > application to specify ports to be used for IPsec UDP encapsulation as
> > they are dynamically changed by NAT in between. Also adding an extra
> > flag to indicate whether PMD needs to perform encapsulation header
> > verification in case of inbound. In case of inline IPsec
> > implementation, verification of outer IP headers and UDP encapsulation
> > headers need to be handled in the PMD. For lookaside IPsec,
> > application can optionally offload this to the PMD.
> >
> > Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
> > ---
> 
> I think we should add some usage of these newly added params
> - either in app/test or in examples/ipsec-secgw

[Tejasree] You mean adding test case in either of the above apps or addition of PMD implementation also? Also is the proposal sounds fine?

> 
> Regards,
> Akhil

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [dpdk-dev] [PATCH] security: allow application to specify UDP ports to PMD
  2020-09-21  9:13   ` Tejasree Kondoj
@ 2020-09-21  9:30     ` Akhil Goyal
  2020-09-21 12:03       ` Tejasree Kondoj
  0 siblings, 1 reply; 7+ messages in thread
From: Akhil Goyal @ 2020-09-21  9:30 UTC (permalink / raw)
  To: Tejasree Kondoj, Radu Nicolau
  Cc: Narayana Prasad Raju Athreya, Anoob Joseph, dev

Hi Tejasree,

> > > Add UDP source and destination ports in ipsec_xform to allow
> > > application to specify ports to be used for IPsec UDP encapsulation as
> > > they are dynamically changed by NAT in between. Also adding an extra
> > > flag to indicate whether PMD needs to perform encapsulation header
> > > verification in case of inbound. In case of inline IPsec
> > > implementation, verification of outer IP headers and UDP encapsulation
> > > headers need to be handled in the PMD. For lookaside IPsec,
> > > application can optionally offload this to the PMD.
> > >
> > > Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
> > > ---
> >
> > I think we should add some usage of these newly added params
> > - either in app/test or in examples/ipsec-secgw
> 
> [Tejasree] You mean adding test case in either of the above apps or addition of
> PMD implementation also? Also is the proposal sounds fine?
> 
I would say both, so that the newly added parameters are tested.
I am ok with the proposal with a minor comment,

We can have udp_src_port and udp_dst_port directly into rte_security_ipsec_xform
Instead of adding a new struct rte_security_ipsec_udp_encapsulation.

Regards,
Akhil

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [dpdk-dev] [PATCH] security: allow application to specify UDP ports to PMD
  2020-09-21  9:30     ` Akhil Goyal
@ 2020-09-21 12:03       ` Tejasree Kondoj
  2021-01-11 19:20         ` Akhil Goyal
  0 siblings, 1 reply; 7+ messages in thread
From: Tejasree Kondoj @ 2020-09-21 12:03 UTC (permalink / raw)
  To: Akhil Goyal, Radu Nicolau; +Cc: Narayana Prasad Raju Athreya, Anoob Joseph, dev

Please see inline.

Thanks
Tejasree

> -----Original Message-----
> From: Akhil Goyal <akhil.goyal@nxp.com>
> Sent: Monday, September 21, 2020 3:01 PM
> To: Tejasree Kondoj <ktejasree@marvell.com>; Radu Nicolau
> <radu.nicolau@intel.com>
> Cc: Narayana Prasad Raju Athreya <pathreya@marvell.com>; Anoob Joseph
> <anoobj@marvell.com>; dev@dpdk.org
> Subject: [EXT] RE: [PATCH] security: allow application to specify UDP ports to
> PMD
> 
> External Email
> 
> ----------------------------------------------------------------------
> Hi Tejasree,
> 
> > > > Add UDP source and destination ports in ipsec_xform to allow
> > > > application to specify ports to be used for IPsec UDP
> > > > encapsulation as they are dynamically changed by NAT in between.
> > > > Also adding an extra flag to indicate whether PMD needs to perform
> > > > encapsulation header verification in case of inbound. In case of
> > > > inline IPsec implementation, verification of outer IP headers and
> > > > UDP encapsulation headers need to be handled in the PMD. For
> > > > lookaside IPsec, application can optionally offload this to the PMD.
> > > >
> > > > Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
> > > > ---
> > >
> > > I think we should add some usage of these newly added params
> > > - either in app/test or in examples/ipsec-secgw
> >
> > [Tejasree] You mean adding test case in either of the above apps or
> > addition of PMD implementation also? Also is the proposal sounds fine?
> >
> I would say both, so that the newly added parameters are tested.
> I am ok with the proposal with a minor comment,
> 
> We can have udp_src_port and udp_dst_port directly into
> rte_security_ipsec_xform Instead of adding a new struct
> rte_security_ipsec_udp_encapsulation.
 
[Tejasree] Okay. We'll defer the patch for now.
Will add usage of the params and address the comment later.

> 
> Regards,
> Akhil

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [dpdk-dev] [PATCH] security: allow application to specify UDP ports to PMD
  2020-09-21 12:03       ` Tejasree Kondoj
@ 2021-01-11 19:20         ` Akhil Goyal
  2021-01-12  6:51           ` Tejasree Kondoj
  0 siblings, 1 reply; 7+ messages in thread
From: Akhil Goyal @ 2021-01-11 19:20 UTC (permalink / raw)
  To: Tejasree Kondoj, Radu Nicolau
  Cc: Narayana Prasad Raju Athreya, Anoob Joseph, dev

Hi Tejasree,

> > > >
> > > > I think we should add some usage of these newly added params
> > > > - either in app/test or in examples/ipsec-secgw
> > >
> > > [Tejasree] You mean adding test case in either of the above apps or
> > > addition of PMD implementation also? Also is the proposal sounds fine?
> > >
> > I would say both, so that the newly added parameters are tested.
> > I am ok with the proposal with a minor comment,
> >
> > We can have udp_src_port and udp_dst_port directly into
> > rte_security_ipsec_xform Instead of adding a new struct
> > rte_security_ipsec_udp_encapsulation.
> 
> [Tejasree] Okay. We'll defer the patch for now.
> Will add usage of the params and address the comment later.
> 
Any updates on this patch.

Regards,
Akhil

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [dpdk-dev] [PATCH] security: allow application to specify UDP ports to PMD
  2021-01-11 19:20         ` Akhil Goyal
@ 2021-01-12  6:51           ` Tejasree Kondoj
  0 siblings, 0 replies; 7+ messages in thread
From: Tejasree Kondoj @ 2021-01-12  6:51 UTC (permalink / raw)
  To: Akhil Goyal, Radu Nicolau; +Cc: Narayana Prasad Raju Athreya, Anoob Joseph, dev

Hi Akhil,

Please see inline.

Thanks
Tejasree

> -----Original Message-----
> From: Akhil Goyal <akhil.goyal@nxp.com>
> Sent: Tuesday, January 12, 2021 12:50 AM
> To: Tejasree Kondoj <ktejasree@marvell.com>; Radu Nicolau
> <radu.nicolau@intel.com>
> Cc: Narayana Prasad Raju Athreya <pathreya@marvell.com>; Anoob Joseph
> <anoobj@marvell.com>; dev@dpdk.org
> Subject: [EXT] RE: [PATCH] security: allow application to specify UDP ports to
> PMD
> 
> External Email
> 
> ----------------------------------------------------------------------
> Hi Tejasree,
> 
> > > > >
> > > > > I think we should add some usage of these newly added params
> > > > > - either in app/test or in examples/ipsec-secgw
> > > >
> > > > [Tejasree] You mean adding test case in either of the above apps
> > > > or addition of PMD implementation also? Also is the proposal sounds
> fine?
> > > >
> > > I would say both, so that the newly added parameters are tested.
> > > I am ok with the proposal with a minor comment,
> > >
> > > We can have udp_src_port and udp_dst_port directly into
> > > rte_security_ipsec_xform Instead of adding a new struct
> > > rte_security_ipsec_udp_encapsulation.
> >
> > [Tejasree] Okay. We'll defer the patch for now.
> > Will add usage of the params and address the comment later.
> >
> Any updates on this patch.

[Tejasree] Not yet. We'll address it later as it needs internal firmware changes.

>
> Regards,
> Akhil

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2021-01-12  6:51 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-09-03  6:42 [dpdk-dev] [PATCH] security: allow application to specify UDP ports to PMD Tejasree Kondoj
2020-09-10 19:09 ` Akhil Goyal
2020-09-21  9:13   ` Tejasree Kondoj
2020-09-21  9:30     ` Akhil Goyal
2020-09-21 12:03       ` Tejasree Kondoj
2021-01-11 19:20         ` Akhil Goyal
2021-01-12  6:51           ` Tejasree Kondoj

DPDK patches and discussions

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://inbox.dpdk.org/dev/0 dev/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 dev dev/ https://inbox.dpdk.org/dev \
		dev@dpdk.org
	public-inbox-index dev

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://inbox.dpdk.org/inbox.dpdk.dev


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git